Bot and spam protection: forms, sign-ups and scraping

Bot protection works in layers: simple traps and checks in forms stop most primitive bots, rate limits prevent mass actions, and invisible behaviour checks and CAPTCHAs kick in only for suspicious visitors. The goal is to make abuse expensive without getting in real people's way.

Here is what damage bots do, how to protect forms and sign-ups, how to fight SMS pumping and scraping and how not to block your own users.

What damage do bots do?

A large share of any public site's traffic is automated. Some bots are useful — search crawlers, monitoring — but the rest create direct costs and risks.

• form spam — managers waste time on junk leads;
• fake sign-ups — they clutter the database and skew analytics;
• SMS pumping — bots request codes to premium numbers and you pay for the messages;
• credential stuffing — trying leaked email-password pairs;
• scraping — competitors download prices and the catalogue, adding load;
• scalping — bots buy limited items or tickets before people can.

How do you protect forms without annoying CAPTCHAs?

Protect contact and lead forms first with checks humans never notice. They stop most primitive spam without adding a single step for people.

Method	How it works	What it stops
Honeypot field	A field invisible to people that bots fill in	Simple bots
Fill time	The form was submitted 1 second after loading	Scripts without a browser
Form token	A one-time token issued when the page loads	Direct requests that skip the page
Rate limit	No more than N submissions per address and device	Mass submissions
Invisible check	Analysis of behaviour and browser	More advanced bots
Visible CAPTCHA	A task for a human	The remainder — suspicious visitors only

public function store(LeadRequest $request)
{
    $shownAt = $request->session()->get('form_shown_at');
    $tooFast = $shownAt === null || $shownAt->diffInSeconds(now()) < 3;

    // Honeypot filled or form submitted too fast — accept silently and do not save
    if ($request->filled('website') || $tooFast) {
        return response()->json(['ok' => true]);
    }

    Lead::create($request->validated());

    return response()->json(['ok' => true]);
}

Photo: Unsplash

How do you fight SMS pumping and fake sign-ups?

SMS pumping is when bots mass-request verification codes to numbers from which attackers get a share of the fees. A single night's attack can cost thousands of dollars, so SMS needs especially careful protection.

1. Limit sending: one code per minute per number and a small daily cap per number, IP and device.
2. Restrict countries and number ranges if your audience is in one country.
3. Run an invisible check before sending a code.
4. Alert on sudden spikes and set a daily spending cap with your SMS provider.
5. Use cheaper channels where possible: codes via messenger, email or passkeys — see two-factor authentication and passkeys.

How do you limit scraping?

Scraping cannot be banned outright, but it can be made slow and expensive. Usually rate limits, detection of unusual behaviour and gating some data behind sign-in are combined.

• rate limits on the catalogue and API — see rate limiting;
• CDN-level bot protection — see how a CDN works;
• blocking data centres and proxies that never bring real customers;
• wholesale prices and stock only for signed-in customers;
• anomaly monitoring: thousands of catalogue pages in a row with no actions.

How do you avoid blocking real users?

Every defence has false positives: an office or mobile carrier may sit behind one IP, and some people disable JavaScript or use blockers. So instead of hard blocking, escalate checks step by step and watch the consequences.

• invisible check first, visible CAPTCHA only on suspicion, blocking as a last resort;
• exempt search crawlers, verifying them by reverse DNS;
• watch form and sign-up conversion after enabling protection;
• give blocked users a clear way to get in touch.

On other vulnerabilities, see OWASP Top 10 explained.

In short

• Bots spam, create fake accounts, pump SMS, stuff credentials and scrape data.
• Protect forms invisibly first: honeypot, fill time, token, limits.
• Guard SMS most strictly: per-number and per-device limits, countries, a spending cap.
• Scraping cannot be banned, but it can be made expensive.
• Escalate checks gradually and make sure conversion does not suffer.